kernel/linux
0
Fork 0
mirror of https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/ synced 2026-10-24 19:10:26 +00:00
Code Issues Releases Packages Activity
linux/drivers/staging/media
History
Zhipeng Lu a1ab99dcc8 media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries 
[ Upstream commit 3b621e9e9e ]

The allocation failure of mycs->yuv_scaler_binary in load_video_binaries()
is followed with a dereference of mycs->yuv_scaler_binary after the
following call chain:

sh_css_pipe_load_binaries()
  |-> load_video_binaries(mycs->yuv_scaler_binary == NULL)
  |
  |-> sh_css_pipe_unload_binaries()
        |-> unload_video_binaries()

In unload_video_binaries(), it calls to ia_css_binary_unload with argument
&pipe->pipe_settings.video.yuv_scaler_binary[i], which refers to the
same memory slot as mycs->yuv_scaler_binary. Thus, a null-pointer
dereference is triggered.

Link: https://lore.kernel.org/r/20240118151303.3828292-1-alexious@zju.edu.cn

Fixes: a49d25364d ("staging/atomisp: Add support for the Intel IPU v2")
Signed-off-by: Zhipeng Lu <alexious@zju.edu.cn>
Reviewed-by: Andy Shevchenko <andy.shevchenko@gmail.com>
Signed-off-by: Hans de Goede <hdegoede@redhat.com>
Signed-off-by: Mauro Carvalho Chehab <mchehab@kernel.org>
Signed-off-by: Sasha Levin <sashal@kernel.org>
History 2024-06-12 11:03:25 +02:00
..
atomisp media: atomisp: ssh_css: Fix a null-pointer dereference in load_video_binaries 2024-06-12 11:03:25 +02:00
deprecated media: ttpci: fix two memleaks in budget_av_attach 2024-03-26 18:20:51 -04:00
imx media: imx: csc/scaler: fix v4l2_ctrl_handler memory leak 2024-03-26 18:20:49 -04:00
ipu3 media: staging: ipu3-imgu: Set fields before media_entity_pads_init() 2024-04-03 15:19:23 +02:00
max96712 i2c: Make remove callback return void 2022-08-16 12:46:26 +02:00
meson/vdec media: meson: vdec: fix possible refcount leak in vdec_probe() 2022-09-24 08:55:43 +02:00
omap4iss media: Prefer designated initializers over memset for subdev pad ops 2023-05-24 17:32:36 +01:00
rkvdec media: rkvdec: Hook the (TRY_)DECODER_CMD stateless ioctls 2024-01-25 15:27:32 -08:00
sunxi media: cedrus: h265: Fix configuring bitstream size 2024-03-26 18:20:49 -04:00
tegra-video staging: media: tegra-video: fix device_node use after free 2023-01-07 11:11:49 +01:00
Kconfig media: destage Hantro VPU driver 2022-08-31 10:23:50 +02:00
Makefile media: destage Hantro VPU driver 2022-08-31 10:23:50 +02:00